7 mincritical
EDR killers explained: Beyond the drivers
Ransomware affiliates increasingly rely on EDR killers—ranging from BYOVD exploits and abused anti-rootkits to driverless tools—to disrupt security solutions prior to deploying encryptors. This approach allows encryptors to remain simple while the EDR killers handle complex defense evasion, complicating attribution and defense strategies.
Sens:■ ImmediateConf:highAnalyzed:2026-03-19reports
Showing defanged values
- sha1002573D80091F7F8167BCBDA3A402B85FA915F19EDRSilencer EDR killer executable
- sha1083F604377D74C4377822EF35021E34AD7DACEEASusanoo EDR killer executable
- sha1148C0CDE4F2EF807AEA77D7368F00F4C519F47EFBaidu Antivirus BdApi vulnerable driver (BdApiUtil64.sys)
- sha1468121E7D6952799F92940677268937C4C5F92EDK7RKScan Kernel Module vulnerable driver (K7RKScan.sys)
- sha154547180A99474B0DBA289D92C4A8F3EEA78B531AbyssKiller EDR killer executable
- sha15D6B9E80E12BFC595D4D26F6AFB099B3CB471DD4Avast anti-rootkit vulnerable driver (aswArPot.sys)
- sha165C2388B0AFB1D1F1860BB887456D8D6CD8B5645EDRKillShifter EDR killer executable
- sha1711C95FEAD2215E9AC59E32E6E3B0D71AD5C5AA5DemoKiller EDR killer executable
Key Takeaways
- EDR killers are a fundamental part of modern ransomware intrusions, allowing attackers to disrupt security solutions rather than modifying encryptors to evade detection.
- Affiliates, not RaaS operators, typically select and deploy EDR killers, leading to high tooling diversity across intrusions.
- Driver-based attribution is often misleading because the same vulnerable driver is reused across unrelated tools, and tools frequently swap drivers.
- The EDR killer landscape includes BYOVD exploits, legitimate anti-rootkits (e.g., GMER), driverless tools (e.g., EDRSilencer), and custom scripts.
- Commercial 'EDR killer as a service' offerings are growing, incorporating advanced evasion techniques like packing, encrypted payloads, and potentially AI-assisted code generation.
Affected Systems
- Windows
- Endpoint Detection and Response (EDR) solutions
- Antivirus (AV) solutions
Vulnerabilities (CVEs)
- CVE-2024-51324
Attack Chain
Attackers gain high privileges on a victim's machine and deploy an EDR killer to neutralize security software. They may use BYOVD techniques to load a vulnerable driver, abuse legitimate anti-rootkit tools, or use driverless methods to suspend or block EDR telemetry. Once the security controls are disabled or blinded, the attackers deploy and execute the ransomware encryptor without interference.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide specific detection rules, but mentions that a comprehensive list of IoCs and samples can be found in the ESET GitHub repository.
Detection Engineering Assessment
EDR Visibility: Medium — EDRs can see the initial deployment and driver loading attempts, but if the EDR killer successfully exploits a driver or blocks telemetry, visibility is lost immediately prior to encryption. Network Visibility: Low — EDR killers operate locally on the endpoint to terminate processes or block local telemetry; network activity is minimal unless downloading the driver/tool. Detection Difficulty: Hard — Attackers use legitimate, signed drivers (BYOVD) and commercial packers, making signature-based detection difficult. Driverless tools and rapid tool switching further complicate detection.
Required Log Sources
- Event ID 7045 (Service Creation)
- Event ID 4688 (Process Creation)
- Event ID 4656 (Handle to Object Requested)
- Sysmon Event ID 6 (Driver Loaded)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for unexpected service creation events (Event ID 7045) loading known vulnerable drivers (e.g., BdApiUtil.sys, aswArPot.sys) from unusual directories like AppData or Temp. | Windows System Event Log (Event ID 7045) | Privilege Escalation | Low |
| Monitor for command-line execution of 'sc create' or 'sc start' targeting kernel drivers immediately followed by the termination of security-related processes. | Process Creation Logs (Event ID 4688 / Sysmon Event ID 1) | Defense Evasion | Medium |
| Hunt for the execution of known anti-rootkit tools (e.g., GMER, PC Hunter) on endpoints where they are not part of the standard administrative toolkit. | Process Creation Logs (Event ID 4688 / Sysmon Event ID 1) | Defense Evasion | Low |
Control Gaps
- Over-reliance on driver blocklists (Microsoft Vulnerable Driver Blocklist) which can be bypassed or lag behind newly discovered vulnerable drivers.
- Inability to prevent execution of tools signed with stolen or expired certificates if revocation checks fail or are bypassed.
Key Behavioral Indicators
- Service creation for kernel drivers from user profiles
- Execution of taskkill or net stop targeting AV/EDR services
- Unexpected reboot into Safe Mode
False Positive Assessment
- Medium
Recommendations
Immediate Mitigation
- Implement and enforce Microsoft's recommended driver block rules to prevent known vulnerable drivers from loading.
- Monitor for and block the hashes of known EDR killers and abused drivers provided in the IoCs.
Infrastructure Hardening
- Enable Windows Defender Application Control (WDAC) or similar application whitelisting to restrict the execution of unapproved binaries and drivers.
- Ensure LSA Protection and Tamper Protection are enabled on all endpoint security agents.
User Protection
- Restrict local administrative privileges to prevent unauthorized users or compromised accounts from loading kernel drivers or modifying system services.
Security Awareness
- Train SOC analysts to treat any alert related to EDR tampering or unexpected driver loading as a critical, high-priority incident requiring immediate containment.
MITRE ATT&CK Mapping
- T1059.003 - Command and Scripting Interpreter: Windows Command Shell
- T1569.002 - System Services: Service Execution
- T1543.003 - Create or Modify System Process: Windows Service
- T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)
- T1068 - Exploitation for Privilege Escalation
- T1562.001 - Impair Defenses: Disable or Modify Tools
- T1562.009 - Impair Defenses: Safe Mode Boot
- T1070.004 - Indicator Removal: File Deletion
- T1562.006 - Impair Defenses: Indicator Blocking
- T1027 - Obfuscated Files or Information
- T1027.009 - Obfuscated Files or Information: Embedded Payloads
- T1027.002 - Obfuscated Files or Information: Software Packing
- T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools
- T1140 - Deobfuscate/Decode Files or Information
- T1490 - Inhibit System Recovery
- T1489 - Service Stop
Additional IOCs
- File Hashes:
75F85CAEA52FE5A124FA77E2934ABD3161690ADD(SHA1) - The ABYSSWORKER rootkit (smuot.sys)1E7567C0D525AD037FBBBAFB643BF40541994411(SHA1) - EDR-Freeze EDR killerA9F37104D2D89051F34E1486BC6EBFF44D147E67(SHA1) - DLKiller EDR killer570161A420992280A8ECED253EDC800296B72D1C(SHA1) - HexKiller EDR killerBBE0E14BC7ECE8A7A1236D5A12E30476CFCEF110(SHA1) - SevexKiller EDR killer31CE76931CA09D3918B34E3187703BC72E6D647E(SHA1) - TfSysMon-Killer EDR killerB9820BF443C375577CEEF44B9491E3A569A1B9E8(SHA1) - dead-av EDR killer34270B07538B7357CF10D0D5BDA68F234B602F93(SHA1) - GhostDriver EDR killer09735640D6634B0303755A9FD3B2BC80F932126C(SHA1) - SmilingKiller EDR killer85BC0A4F67522D6AC6BE64D763E65A2945EC5028(SHA1) - kill-floor EDR killerBC65ED919988C8E4B8F5A1CD371745456601700A(SHA1) - DemoKiller EDR killer (demo.exe)C881F43C7FE94A6F056A84DA8E9A32FE56D8DD9C(SHA1) - ThreatFire System Monitor vulnerable driver (TfSysMon.sys)67D17CA90880B448D5C3B40F69CEC04D3649F170(SHA1) - Rentdrv2 vulnerable driverF329AE0FDF1E198BEA6BA787E59CB73F90714002(SHA1) - USB-C Power Delivery Firmware Update Utility vulnerable driver (data.sys)82ED942A52CDCF120A8919730E00BA37619661A3(SHA1) - ThrottleStop vulnerable driverCE1B9909CEF820E5281618A7A0099A27A70643DC(SHA1) - Custom rootkit used by CardSpaceKiller (hlpdrv.sys)7310D6399683BA3EB2F695A2071E0E45891D743B(SHA1) - ITM SYSTEM File Filter vulnerable driver (probmon.sys)C85C9A09CD1CB1691DA0D96772391BE6DDBA3555(SHA1) - Beijing Rising Network Security vulnerable driver (kl.sys)6EE94F6BDC4C4ED0FFF621FEC36C70FF093659ED(SHA1) - OCular THelper vulnerable driver (msupdate.sys)BA14C43031411240A0836BEDF8C8692B54698E05(SHA1) - MS4Killer EDR killer127B50C8185986A52AE66BF6E7E67A6FD787C4FC(SHA1) - CardSpaceKiller EDR killer (version.dll)A3BDB419703A70157F2B7BD1DC2E4C9227DD9FE8(SHA1) - CardSpaceKiller EDR killer (0th3r_av5.exe)4A57083122710D51F247367AFD813A740AC180A1(SHA1) - CardSpaceKiller EDR killerDB8BCB8693DDF715552F85B8E2628F060070F920(SHA1) - CardSpaceKiller EDR killer (HwRwDrv.sys)
- File Paths:
C:\Users\Default\AppData\Local\Microsoft\Windows\ntfs.bin- File path used by SmilingKiller/kill-floor to drop embedded driversC:\Users\Default\AppData\Local\Microsoft\Windows\wamsdk.sys- File path used by SmilingKiller/kill-floor to drop embedded drivers
- Command Lines:
- Purpose: Terminate security product processes | Tools:
taskkill| Stage: Defense Evasion |taskkill /f /im - Purpose: Stop security product services | Tools:
net| Stage: Defense Evasion |net stop - Purpose: Delete security product services | Tools:
sc| Stage: Defense Evasion |sc delete - Purpose: Create a service for a vulnerable driver | Tools:
sc| Stage: Privilege Escalation / Defense Evasion |sc create aswArPot.sys type=kernel binpath= - Purpose: Start a vulnerable driver service | Tools:
sc| Stage: Privilege Escalation / Defense Evasion |sc start aswArPot.sys - Purpose: Create a service for a vulnerable driver | Tools:
sc| Stage: Privilege Escalation / Defense Evasion |sc create K7RKScan type= kernel binpath= - Purpose: Start a vulnerable driver service | Tools:
sc| Stage: Privilege Escalation / Defense Evasion |sc start K7RKScan
- Purpose: Terminate security product processes | Tools:
